1. Who We Are

EchoPitch is a product of Cavefish, a company registered in England and Wales. Cavefish is the data controller responsible for your personal data.

ICO Registration: ZB915633
Contact: hello@cavefish.ai

2. Data We Collect

We collect the following types of data:

Account Information: Email address, name, and password (hashed)
Practice Videos: Video and audio recordings you create during practice sessions
Usage Data: How you interact with EchoPitch, session timestamps, and feature usage
Device Information: Browser type, operating system, and IP address

3. How We Process Your Data

Important: We process your data to provide our service — we do not store your practice videos permanently. Videos are processed in real-time to generate feedback and are not retained after analysis is complete.

We process your data for the following purposes:

To provide AI-powered feedback on your presentations
To track your progress and improvement over time
To improve our AI models and service quality
To communicate with you about your account and our services
To comply with legal obligations

4. AI Model Training

We may use anonymised and aggregated data from your practice sessions to improve and fine-tune our AI models. This helps us provide better feedback to all users.

You can opt out of having your data used for model improvement in your account settings. Opting out will not affect the quality of feedback you receive.

5. Legal Basis for Processing

Under GDPR, we process your data based on:

Contract: To provide the service you signed up for
Legitimate Interest: To improve our service and prevent fraud
Consent: For optional features like marketing communications
Legal Obligation: To comply with applicable laws

6. Data Retention

We retain your data only as long as necessary:

Account data: Until you delete your account
Practice videos: Processed and deleted immediately after analysis
Feedback and scores: Until you delete your account
Usage analytics: 24 months, then anonymised

7. Your Rights

Under GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Delete your account and all associated data
Portability: Receive your data in a machine-readable format
Objection: Object to certain processing activities
Restriction: Limit how we process your data

To exercise these rights, contact us at hello@cavefish.ai.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security audits.

Third-Party Sub-Processors: We use the following service providers to deliver EchoPitch:

Vercel Inc. (USA) — Hosting and infrastructure
Hume AI Inc. (USA) — Real-time emotion analysis and facial expression processing
Google LLC (USA) — Analytics (Google Analytics 4) with consent-based tracking
Formspree Inc. (USA) — Contact form processing
Stripe Inc. (USA) — Payment processing

9. International Transfers

Your data may be processed by AI providers and infrastructure services located outside the UK/EEA, specifically Hume AI (emotion analysis) and Vercel (hosting) in the United States.

Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK ICO, or adequacy decisions. All sub-processors are contractually bound to protect your data to standards equivalent to UK GDPR.

10. Cookies

We use essential cookies to operate our service and analytics cookies to understand usage. You can manage cookie preferences in your browser settings. See our Cookie Policy for details.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the service. Continued use after changes constitutes acceptance.

12. Contact Us

For privacy-related questions or to exercise your rights:

Email: hello@cavefish.ai
Data Controller: Cavefish
ICO Registration: ZB915633

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.

Privacy Policy